password hash & login required rule added